<script src="path/to/webix.js" type="text/javascript" charset="utf-8"></script>
<script>
    webix.exec(document.location.hash); // $ Alert[js/code-injection]
    webix.ui({ template: document.location.hash }); // $ Alert[js/code-injection]
    webix.ui({ template: function () { return document.location.hash } }); // $ Alert[js/code-injection]
</script>